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Abstract 

We present several applications of quantum amplitude amplifica- 
tion to finding claws and collisions in ordered or unordered functions. 
Our algorithms generalize those of Brassard, H0yer, and Tapp, and 
imply an 0(iV 3 / 4 logiV) quantum upper bound for the element dis- 
tinctness problem in the comparison complexity model (contrasting 
with 0(iV dog N) classical complexity). We also prove a lower bound 
of f2(\/iV) comparisons for this problem and derive bounds for a num- 
ber of related problems. 



1 Introduction 

In the last decade, quantum computing has become a prominent and promis- 
ing area of theoretical computer science. Realizing this promise requires two 



Research partially supported by the EU fifth framework program QAIP, 1ST- 1999- 
11234. 

*CWI, P.O. Box 94079, Amsterdam, The Netherlands, email: buhrman@cwi.nl. 

* Universite Paris-Sud, LRI, 91405 Orsay, France, email: durr@lri.fr. 

§ NSA, Suite 6111, Fort George G.Meade, MD 20755. email: mheilig@zombie.ncsc.mil. 

^BRICS, University of Aarhus, Aarhus C, Denmark, email: hoyer@brics.dk. 

" CNRS, Universite Paris-Sud, LRI, 91405 Orsay, France, email: magniez@lri.fr. 
** CNRS, Universite Paris-Sud, LRI, 91405 Orsay, France, email: santha@lri . f r. 
ttCWI, P.O. Box 94079, Amsterdam, The Netherlands, email: rdewolf@cwi.nl. 



1 



things: (1) actually building a quantum computer and (2) discovering tasks 
where a quantum computer is significantly faster than a classical computer. 
Here we are concerned with the second issue. Few good quantum algorithms 
are known to date, the two main examples being Shor's algorithm for fac- 
toring [ |Sho97|1 and Grover's algorithm for searching ||Gro96|| . Whereas the 



first so far has remained a somewhat isolated although seminal result, the 
second has been applied as a building block in quite a few other quantum 
algorithms pH97| , |BHT97| , |BCW98| , |BCWZ99| , ^W99| , |BHMT00| . 



One of the earliest applications of Grover's algorithm was the algorithm 
of Brassard, H0yer, and Tapp |[BHT97|| for finding a collision in a 2-to-l func- 
tion /. A collision is a pair of distinct elements x,y such that f(x) = f(y). 
Suppose the size of /'s domain is N. For a classical randomized algorithm, 
Q(yN) evaluations of the function are necessary and sufficient to find a col- 
lision. The quantum algorithm of |BHT97| finds a collision using 0(N 1 ^ 3 ) 
evaluations of /. No non trivial quantum lower bound is known for this 
problem. A notion related to collisions is that of a claw. A claw in functions 
/ and g is a pair (x,y) such that f(x) = g(y). If / and g are permutations 
on [N] = {1, . . . ,N}, then the function on [2N] which maps the first half 
of the domain according to / and the second half according to g, is a 2-to-l 
function. Thus the algorithm of Brassard, H0yer, and Tapp can also find a 
claw in such / and g using 0(N 1 ^ 3 ) evaluations of / and g. 

In this paper we consider the quantum complexity of collision-finding 
or claw-finding with and without restrictions on the functions / and g. In 
Section [5] we consider the situation where / : [N] — > Z and g : [M] — > Z 
are arbitrary. Our aim is to find a claw between / and g, if one exists. For 
now, let us assume iV = M (in the body of the paper we treat the general 
case). The complexity measure we use is the number of comparisons between 
elements. That is, we assume a total order on Z and our only way to access 
/ and g is by comparing f(x) with f(y), g(x) with g(y), or f(x) with g(y), 
according to this total order. The ability to make such comparisons is weaker 
than the ability to evaluate and actually learn the function values f(x) and 
g{y). However, our bounds remain the same up to logarithmic factors if we 
were to count the number of function-evaluations instead of comparisons. 

An optimal classical algorithm for this general claw-finding problem is 
the following. Viewing / as a list of N items, we can sort it using N log iV + 
O(N) comparisons. Once / is sorted, we can for a given y e [N] find an x 
such that f(x) = g(y) provided such an x exists, using logiV comparisons 
(by utilizing binary search on /). Thus exhaustive search on all y yields 



2 



an 0(N log N) algorithm for finding a claw with certainty, provided one 
exists. This N log N is optimal up to constant factors even for bounded-error 
classical algorithms. Here we show that a quantum computer can do better: 
we exhibit a quantum algorithm that finds a claw with high probability using 
0(iV 3 / 4 log N) comparisons. We also prove a lower bound for this problem of 
Q^N 1 / 2 ) comparisons for bounded-error quantum algorithms and Q,(N) for 
exact quantum algorithms. 

Our algorithm for claw-finding also yields an 0(iV 3 / 4 log iV) bounded- 
error quantum algorithm for finding a collision for arbitrary functions. Note 
that deciding if a collision occurs in / is equivalent to deciding whether / 
maps all x to distinct elements. This is known as the element distinctness 
problem and has been well studied classically, see e.g. [|Yao94|, |LK91|, |Gri98|, 



|BSSV00|| . Element distinctness is particularly interesting because its classi- 
cal complexity is related to that of sorting, which is well known to require 
iVlog N + 0(iV) comparisons. If we sort /, we can decide element distinct- 
ness by going through the sorted list once, which gives a classical upper 
bound of iVlog iV + O(N) comparisons. Conversely, element distinctness re- 
quires Q(NlogN) comparisons in case of classical bounded-error algorithms 
(even in a much stronger model, see [ pri98|| ), so sorting and element dis- 
tinctness are equally hard for classical computers. On a quantum computer, 
the best known upper bound for sorting is roughly 0.53 iVlogiV compari- 
sons [ FGGS99a , whereas the best known lower bound is Q(N) ||FGGS99b . 
Accordingly, our 0(7V 3 / 4 log N) quantum upper bound shows that element 
distinctness is significantly easier than sorting for a quantum computer, in 
contrast to the classical case. 

In Section |], we consider the case where / is ordered (monotone non- 
decreasing): /(l) < /(2) < • - • < f(N). In this case, the quantum com- 
plexity of claw-finding and collision finding drops from 0(iV 3 / 4 log N) to 
0(N 1 ^ 2 log N). In Section |5] we show how to remove the logiV factor (re- 
placing it by a near-constant function) if both / and g are ordered. The 
lower bound for this restricted case remains f^iV 1 / 2 ). 

In Section ^] we give some problems related to the element distinctness 
problem for which quantum computers cannot help. We then, in Section [7], 
give bounds for the number of edges a quantum computer needs to query in 
order to find a triangle in a given graph (which, informally, can be viewed 
as a collision between three nodes). Finally, we end with some concluding 
remarks in Section |8|. 
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2 Preliminaries 



We consider the following problems: 

Claw-finding problem 

Given two functions / : X — > Z and g : Y — > Z, find a pair (x, y) G 
X xY such that f(x) = g(y). 

Collision-finding problem 

Given a function / : X — > Z, find two distinct elements x, y G X such 
that f(x) = f(y). 

We assume that X = [N] = {1, . . . , N} and Y = [M\ = {1, . . . , M} with 
iV<M. 

For details about quantum computing we refer to ||Ber97| , |Gle99|| . We for- 



malize a comparison between f(x) and f(y) as an application of the following 
unitary transformation: 

\x,y,b) i — > \x,y,b@ [f(x) < f(y)\), 

where b G {0, 1} and [f(x) < f(y)] denotes the truth-value of the statement 
u f{ x ) < f{y)" ■ We formalize comparisons between f(x) and g(y) similarly. 

We are interested in the number of comparisons required for claw-finding 
or collision-finding. We use Qe{P) and Q2OP) f° r the worst-case number 
of comparisons required for solving problem P by exact and bounded-error 
quantum algorithms, respectively. In our algorithms we make abundant use 
of quantum amplitude amplification |BHMT0CT| , which generalizes quantum 



search [ Gro96|| . The essence of amplitude amplification can be summarized 



by following theorem. 

Theorem 1 (Amplitude amplification) There exists a quantum algorithm 
QSearch with the following property. Let A be any quantum algorithm that 
uses no measurements, and let \ : Z — > {0, 1} be any Boolean function. Let a 
denote the initial success probability of A of finding a solution (i.e. the prob- 
ability of outputting z s.t. x( z ) — 1/ Algorithm QSearch finds a solution 
using an expected number of 0(1/ \fa) applications of A and A~ x if a > 0, 
and otherwise runs forever. 

The algorithm QSearch does not need to know the value of a in advance, 
but if a is known, it can find a solution in worst-case 0(l/^/a) applications. 
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Grover's algorithm for searching a space of N items is a special case 
of amplitude amplification. If A is the classical algorithm which selects a 
random element of the space and checks it, then a = 1/N, and amplitude 
amplification implies an 0(N 1 / 2 ) quantum algorithm for searching the space. 
We refer to this process as "quantum searching" . 

3 Finding claws if / and g are not ordered 

First we consider the most general case, where / and g are arbitrary, pos- 
sibly unordered functions. Our claw-finding algorithms are instances of 
the following generic algorithm, which is parameterized by an integer £ < 
min{iV, y/M}: 

Algorithm Generic claw-finder 

1. Select a random subset A C [N] of size £ 

2. Select a random subset B C [M] of size £ 2 

3. Sort the elements in A according to their /-value 

4. For a specific b G B, we can check if there is an a G A such that 
(a, b) is a claw using classical binary search on the sorted version of A. 
Combine this with quantum search on the 5-elements to search for a 
claw in A x B. 

5. Apply amplitude amplification on steps [l|-44| 

We analyze the comparison-complexity of this algorithm. Step ^ just em- 
ploys classical sorting and hence takes £\og£ + 0(£) comparisons. Step § 
takes 0(y \B\ log \A\) = 0(£\og£) comparisons, so steps [L]-[| take 0(£\og£) 
comparisons in total. 

If no claws between / and g exist, then this algorithm does not terminate. 
Now suppose there is a claw (x, y) G X x Y . Then (x, y) G A x B with 
probability (£/N) ■ (£ 2 /M), and if indeed (x,y) G A x B, then step | will 
find this (or some other) collision with probability at least 1/2 in at most 
0(£log£) comparisons. Hence the overall success probability of steps [!]-§] is 
at least a = £ 3 /2NM, and the amplitude amplification of step 5 requires 
an expected number of 0(y/NM/£?) iterations of steps |l]-4l[ Accordingly, 
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the total expected number of comparisons to find a claw is 0(<J ^y^log£), 
provided there is one. In order to minimize the number of comparisons, 
we maximize I, subject to the constraint I < mm{N } \/M}. This gives 
upper bounds of 0{N l / 2 M 1 / i log N) comparisons if N < M < N 2 , and 
0{M 1 ' 2 \ogN) if M > N 2 . 

What about lower bounds for the claw-finding problem? We can reduce 
the OR-problem to claw-finding as follows. Given a function g : [M] — > 
{0, 1}, by definition OR(g) is 1 if there is an i such that g(i) = 1. To 
determine this value, we set N = 1 and define f(l) = 1. Then there is a 
claw between / and g if and only if OR(g) = 1. Thus if we can find a claw 
using c comparisons, we can decide OR using 2c queries to g (two g-queries 
suffice to implement a comparison). Using known lower bounds for the OR- 
function pBBV97| , [BBC + 98|1 , this gives an fl(M) bound for exact quantum 
and an Vt(\fM) bound for bounded-error quantum algorithms. The next 
theorem follows. 

Theorem 2 The comparison- complexity of the claw-finding problem is 

. niM^ 2 ) < O (Claw) < / °( Nl/2Ml/A ^N) if N < M < N 2 

• i2(M ) < g 2 (Claw) < | 0(M i/ 2logiV) ifM > N 2 

• ft(Af) < Q e (C\slw) < 0(M log N). 

The bounds for the case M > N 2 and the case of exact computation are 
tight up to the logiV term, but the case M < N 2 is nowhere near tight. 
In particular, for iV = M the complexity lies somewhere between N 1 ^ 2 and 

AT3/4 log Nm 

Now consider the problem of finding a collision for an arbitrary function 
/ : [N] — > Z. A simple modification of the above algorithm for claw-finding 
works fine to find such (x, y)-pairs if they exist (put g = f and avoid claws of 
the form (x,x)), and gives that Q 2 (ED) E 0(N 3/4 log N). The best known 
lower bounds follow again via reductions from the OR-problem: given X G 
{0, 1}* we define / : [N+l] -> {0, . . . , iV} as f(i) = i(l-Xi) and /(iV+1) = 
0. Now OR(X) = 1 if and only if / contains a collision. As mentioned in 
the introduction, the problem of deciding if there is a collision is equivalent 
to the element distinctness (ED) problem. Theorem 131 follows. 
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Theorem 3 The comparison- complexity of the element distinctness problem 



is 



• ^(iV 1 / 2 ) < g 2 (ED) < 0(iV 3/4 log iV) 

• n(N) < Q E (ED) < 0(N\ogN). 

In contrast, for classical (exact or bounded-error) algorithms, element 
distinctness is as hard as sorting and requires Q(NlogN) comparisons. 

Collision-finding becomes cheaper if we know that some value z G Z oc- 
curs at least k times. If we pick a random subset S of ION/ k of the domain, 
then with high probability at least two pre-images of z will be contained in 
S. Thus running our algorithm on S will find a collision with high proba- 
bility, resulting in complexity 0((N/k) 3 ^log(N/k)). Also, if / is a 2-to-l 
function, we can rederive the 0(N 1 ^ 3 log N) bound of Brassard, H0yer, and 
Tapp ||BHT97|| by taking £ = N 1 ^ 3 . This yields constant success probability 
after steps in the generic algorithm, and hence no further rounds of am- 
plitude amplification are required. As in the case of | |BHT97| |, this algorithm 
can be made exact by using the exact form of amplitude amplification (the 
success probability can be exactly computed in this case). 



4 Finding claws if / is ordered 

Now suppose that function / is ordered: /(l) < /(2) < - • • < f(N), and 
that function g : [M] —> Z is not necessarily ordered. In this case, given 
some y G [M], we can find an x G [N] such that (x, y) is a claw using binary 
search on /. Thus, combining this with a quantum search on all y G [M], we 
obtain the upper bound of 0(VM log N) for finding a claw in / and g. The 
lower bounds of the last section via the OR-reduction still apply, and hence 
we obtain the following theorem. 

Theorem 4 The comparison- complexity of the claw-finding problem with or- 
dered f is 

• QiM 1 / 2 ) < Q 2 (Claw) < C^M 1 / 2 log iV) 

• fi(M) < Qi?(Claw) < 0(M log N). 

Note that collision-finding for an ordered / : [N] — > Z is equivalent to 
searching a space of iV — 1 items (namely all consecutive pairs in the domain 
of /) and hence requires 0(\/N) comparisons. 
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5 Finding claws if both / and g are ordered 



Now consider the case where both / and g are ordered. Assume for simplicity 
that N = M. Again we get an Q(y/~N) lower bound via a reduction from 
the OR-problem as follows. Given an OR-instance X e {0, 1}^, we define 
f,g : [N] -> Z by f(i) = 2i + 1 and g(i) = 2i + x { for all i E [N]. Then / 
and g are ordered, and OR(X) = 1 if and only if there is a claw between / 
and g. The lower bound follows. 

We give a quantum algorithm that solves the problem using 0(y/~N c log *^) 
comparisons for some constant c > 0. The function log*(iV) is defined as the 
minimum number of iterated applications of the logarithm function necessary 
to obtain a number less than or equal to 1: log*(iV) = min-fi > | log^(iV) < 
1}, where log^ = log o log^ -1 ^ denotes the ith iterated application of log, and 
log'- '' is the identity function. Even though c log *^ is exponential in log*(N), 
it is still very small in N, in particular c log *W e (\og (i) (N)) for any con- 
stant % > 1. Thus we replace the logiV in the upper bound of the previous 
section by a near-constant function. Our algorithm defines a set of sub- 
problems such that the original problem (/, g) contains a claw if and only 
if at least one of the subproblems contains a claw. We then solve the origi- 
nal problem by running the subproblems in quantum parallel and applying 
amplitude amplification. 

Let r > be an integer. We define 2 subproblems as follows. 

Definition 5 Let r > be an integer and f,g : [N] — > Z. 

For each < i < \N/r] —1, we define the subproblem (/j, g[) by letting fa 
denote the restriction of f to subdomain [ir+1, (i + l)r\, and g\ the restriction 
°f 9 t° [j) j J r r ~ 1] where j is the minimum j' e [N] such that g(j') > f(ir+l). 

Similarly, for each < j < \N/r \ —1, we define the subproblem (/j, gj) by 
letting gj denote the restriction of g to [jr+1, (j + l)r] 7 and fj the restriction 
of f to [i,i+r — l] where i is the minimumi' e [N] such that f(i') > g(jr+l). 

It is not hard to check that these subproblems all together provide a 
solution to the original problem. 

Lemma 6 Let r > be an integer and f,g : [N] — > Z. Then (f,g) contains 
a claw if and only if for some i or j in [0, \N/r] — 1] the subproblem (fa,g'j) 
or (fj,gj) contains a claw. 
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Each of these 2 [— 1 subproblems is itself an instance of the claw-finding 
problem of size r. By running them all together in quantum parallel and 
then applying amplitude amplification, we obtain our main result. 

Theorem 7 There exists a quantum algorithm that outputs a claw between 
f and g with probability at least | provided one exists, using 
comparisons, for some constant c. 

Proof Let T(N) denote the worst-case number of comparisons required if 
/ and g have domain of size N. We show that 

T(N) < c'^(\log(N + l)] + T(r)\ , (1) 

for some (small) constant c'. Let < i < \N/r\ — 1 and consider the 
subproblem (fi,gl). Using at most [log (AT + 1)] + T(r) comparisons, we 
can find a claw in (fi,g'i) with probability at least |, provided there is one. 
We do that by using binary search to find the minimum j for which g(j) > 
f(ir + 1), at the cost of [log (AT + 1)] comparisons, and then recursively 
determining if the subproblem (/j, g'^ contains a claw at the cost of at most 
T(r) additional comparisons. There are 2 [— ] subproblems, so by applying 
amplitude amplification we can find a claw among any one of them with 
probability at least |, provided there is one, in the number of comparisons 
given in equation ([!]). 

We pick r = [log 2 (A^)]. Since T(r) > Q(y/r) = ft(logiV), equation (0) 
implies 

T(N) < c"^T(r), (2) 

for some constant c" . Furthermore, our choice of r implies that the depth of 
the recursion defined by equation (H) is on the order of log* (A/ - ), so unfolding 
the recursion gives the theorem. □ 



6 Hard problems related to element distinct- 
ness 

In this section, we consider some related problems for which quantum com- 
puters cannot improve upon classical (probabilistic) complexity. 
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Parity-collision problem 

Given function / : X — > Z, find the parity of the cardinality of the set 
C f = {{x, y) G X x X : x < y and f(x) = f(y)}. 

No-collision problem 

Given function / : X — > Z, find an element x G X that is not involved 
in a collision (i.e. f~ 1 {f{x)) = {x}). 

No-range problem 

Given function / : X — > Z, find z G Z such that z G" f{X). 

We assume that X = Z = [iV], and show that these problems are hard 
even for the function-evaluation model. 

Theorem 8 The evaluation- complexities of the parity- collision problem, the 
no-collision problem and the no-range problem are lower bounded by Q(N). 

Note that the hardness of the parity-collision problem implies the hard- 
ness of exactly counting the number of collisions. Our proofs use the nice 
lower bound method developed by Ambainis ||AmbOO |. Let us state here ex- 



actly the result that we require (the result is stated in |AmbOO|l for inputs 
which are Boolean vectors, but holds in our case as well). 

Theorem 9 ( |[AmbOO|| ) Let T = {/ : [N] -> [N]} be the set of all possible 
input-functions, and $ : JF —>■ Z be a function (which we want to compute). 
Let A,B be two subsets of T such that <&(/) 7^ $(#) if f G A and g G B, 
and R C A x B be a relation such that 

1. For every f G A, there exist at least m different g G B such that 

2. For every g G B, there exist at least m! different f G A such that 

(f,g)£R- 

3. For every f G A and x G [N], there exist at most I different g G B such 
that (f,g) G R and f(x) ^ g{x). 

4- For every g G B and x G [N], there exist at most V different f G A 
such that (f,g) G R and f(x) 7^ g(x). 

Then any quantum algorithm computing $ with probability at least 2/3 re- 



quires f2(y^ ^jjr-) evaluation- queries. 
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We now give our proof of Theorem 

Proof To apply Theorem we will describe a relation R for each of our 
problems. For functions / : [N] — > [N] and g : [N] — > [N], we denote by 
d(f,g) the cardinality of the set {x G [N] \ f(x) ^ g{x)}- For each problem 
R will be defined by 

R={{f,g)eAxB\d{f,g) = l}, 
for some appropriate sets A and B. 

Parity-collision problem Here we suppose that 4 divides N. Let A be the 
set of functions / : [N] -> [N] such that |C/| = N/4 and I/" 1 !- 2 )! < 2 
for all z G [AT]. Let B be the set of functions g : [A/] — ► [A/ - ] such 
that \C g \ = N/4 + 1 and \g~ l {z)\ < 2 for all z G [A^]. Then a simple 
computation gives that the relation R satisfies m = 9(A r2 ), m' = 
Q(N 2 ), I = G(N), and V = 0{N). 

No-collision problem Now we suppose that A^ is odd. Let A = B be 
the set of functions / : [N] -> [AT] such that \C f \ = (N - l)/2, and 
< 2, for all z G [N]. Then i? satisfies that m = m' = O(N) 
and / = V = 9(1). 

No-range problem Let A = B be the set of functions / : [N] — > [AT] such 
that = {(1, 2)}. Then a similar computation gives m — m' — 0(AT) 
and / = 1' = 0(1). 

Note that the no-collision problem and the no-range problem are not func- 
tions in general (several outputs may be valid for one input), but that they 
are functions on the sets A and B chosen above (there is a unique correct 
output for each input). Thus, Theorem |9| implies a lower bound of fl(N) for 
the evaluation-complexity of each of our three problems. □ 



7 Finding a triangle in a graph 

Finally we consider a related search problem, which is to find a triangle in 
a graph, provided one exists. Consider an undirected graph G = (V, E) on 
|V| = n nodes with m = \E\ edges. There are A^ = (™) edge slots in E, 
which we can query in a black box fashion (see also ||BCWZ99| , Section 7]). 
The triangle-finding problem is: 
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Triangle-finding problem 

Given undirected graph G = (V,E), find distinct vertices a,b,c E V 
such that (a, b), (a,c), (b, c) G E. 

Since there are (™) < n 3 triples a, b, c, and we can decide whether a given 
triple is a triangle using 3 queries, we can use Grover's algorithm to find a 
triangle in 0(n 3 ^ 2 ) queries. Below we give an algorithm that works more 
efficiently for sparse graphs. 

Algorithm Triangle-finder 

1. Use quantum search to find an edge (a, b) E E among all (™) potential 
edges. 

2. Use quantum search to find a node c E V such that a, b, c is a triangle. 

3. Apply amplitude amplification on steps [l|-|2]. 

Step [I] takes 0(yjn 2 /m) queries and step |2| takes 0(y/n) queries. If 
there is a triangle in the graph, then the probability that step |l] finds an 
edge belonging to this specific triangle is B(l/m). If step [I] indeed finds an 
edge of a triangle, then with probability at least 1/2, step ^| finds a c which 
completes the triangle. Thus the success probability of steps is 0(l/m) 
and the amplitude amplification of step |3] requires 0(\/m) iterations. The 
total complexity is hence 0((yjn 2 /m + Tjn)^m) which is 0(n + ^/nm). If 
G is sparse in the sense that m = \E\ E o(n 2 ), then o(n 3 / 2 ) queries suffice. 
Of course for dense graphs our algorithm will require 0(n 3//2 ) queries. 

We again obtain lower bounds by a reduction from the OR-problem. 

Consider an OR-input X E {0, ljW as a graph on n edges. Let G be the 
graph obtained from this by adding an (n + l)-th node and connecting this 
to all other n nodes. Now G has \X\ + n edges, and OR(X) = 1 if and 
only if G contains a triangle. This gives Q(n 2 ) bounds for exact quantum 
and bounded-error classical, and an Q(n) bound for bounded-error quantum. 
The next theorem follows. 

Theorem 10 IfQ{n) < \E\ < Q), then the edge -query-complexity of triangle- 
finding is 

• £l(n) < (^(Triangle) < 0(n + y/nm) 



12 



Q B (Triangle) = 6(n 2 ) 



where n = \V\ and m = \E\ for G = (V, E). 

Note that for graphs with 0(n) edges, the bounded-error quantum bound 
becomes Q(n) queries, whereas the classical bound remains Q(n 2 ). Thus we 
have a quadratic gap for such very sparse graphs. 



8 Concluding remarks 

The main problem left open by this research is to close the gap between upper 
and lower bounds for element distinctness. None of the known methods for 
proving quantum lower bounds seems to be directly applicable to improve 
the fi(V^V) lower bound, and we feel that if element distinctness is strictly 
harder than unordered search, proving it will require new ideas. 

An interesting direction could be to take into account simultaneously time 
complexity and space complexity, as recently has been done for classical algo- 
rithms by Yao ||Yao94|| , Ajtai ||Ajt9H|| , Beame, Saks, Sun, and Vee ||BSSV00|| , 
and others. In particular, Yao shows that the time-space product of any 
classical deterministic comparison-based branching program solving element 
distinctness satisfies T ■ S > ^(iV 2 ^^), where e(N) = 5/Vln N. A possi- 
ble extension of this result to quantum computation could be that the time 
and space of any quantum bounded-error algorithm for element distinctness 
satisfies T 2 x S > ^l(N 2 ~ 6 ^), for some appropriate function e(N). If such 
a bound is valid, then our iV^-algorithm is near-optimal when the space 
complexity is bounded by 0(N 1 / 2 ) (for our algorithm, the time complexity 
is the same as the comparison complexity up to logarithmic factors). 
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